RE: [SA-list] Authentication Errors

[ServersAlivemailinglist]

Title: Message

:), there you go....  I wish we could have stuck only with SA, but management wanted to monitor all events, and keep security logs, etc....

 

It's still the same 1219 error it is failing with. I looked on the remote servers security log, and didn't see any Denies around  the time when I'm running both apps. I do see Successes for the service account I'm using though... ?

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dirk Bulinckx
Sent: Friday, August 22, 2003 3:04 PM
To: [EMAIL PROTECTED]
Subject: RE: [SA-list] Authentication Errors

An eventlog check in SA would solve it all I suppose :-)

 

If it fails in SA what does the logfile exactly show?  Still the 1219 or another error?  Looking at the remote eventlog could show what user tried to logon, that could already help/explain some....

 

dirk.

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of [EMAIL PROTECTED]
Sent: Fri Aug 22 4:44 PM
To: [EMAIL PROTECTED]
Subject: RE: [SA-list] Authentication Errors

Dirk,

        The problem happened again, and I have finally found the culprit of it. We have another software package called ELM from TNTSoftware that we use to monitor the Event logs on our servers. Apparently when ELM is connecting to the servers, Servers Alive fails on it's authenticated checks. They are both running on the same server as services, and are set to use the same Domain Admin account.

 

From what you explained to me earlier, it seems that this should work ok.? I was running like this with ver 3x, but not using the run as a service feature.

 

Any help or suggestions from anyone would be greatly appreciated.

 

Thanks!

 

Jesse.

 

 

 

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Posted At: Thursday, August 21, 2003 10:29 AM
Posted To: Servers Alive mailing list
Conversation: [SA-list] Authentication Errors
Subject: RE: [SA-list] Authentication Errors

OK, I think I understand now. If someone logs in to the server under their OWN account and opens a resource on the remote server, this will happen. Interesting, I'll keep an eye on it, when \ if it happens again, I'll see who's logged into the server.

 

As always, thanks for your help!!!

 

 

Jesse.

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dirk Bulinckx
Sent: Wednesday, August 20, 2003 2:29 PM
To: [EMAIL PROTECTED]
Subject: RE: [SA-list] Authentication Errors

No only if they are using a different account then the one Servers Alive is using.

 

You're hitting a limit of the OS:

 

1219 Multiple connections to a server or shared resource by the

same user, using more than one user name, are not allowed.

Disconnect all previous connections to the server or shared resource

and try again.

 

 

dirk.

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of [EMAIL PROTECTED]
Sent: Wed Aug 20 8:17 PM
To: [EMAIL PROTECTED]
Subject: RE: [SA-list] Authentication Errors

To make sure I'm understanding, if someone logs on to the server that is running SA, and connects to a share on a monitored server, it will cause this problem? But only if they log in as the account that SA is using to check to the remote systems?

 

Am I understanding that correctly?  I didn't realize that could be a problem, it may very well be the issue if that's so. I can try using a different account for SA  as you mentioned.

 

Thanks for the suggestions....

 

Jesse.

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jonathan Marsden
Sent: Wednesday, August 20, 2003 1:30 PM
To: [EMAIL PROTECTED]
Subject: RE: [SA-list] Authentication Errors

easy way to test what dirk is saying is to create an admin account strictly for SA...so that no one else would be interacting with that account locally...

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Wednesday, August 20, 2003 1:20 PM
To: [EMAIL PROTECTED]
Subject: RE: [SA-list] Authentication Errors

Could it be that somebody logged on to the system (localy) and made a connection to these remote systems?

 

dirk.

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of [EMAIL PROTECTED]
Sent: Wed Aug 20 5:34 PM
To: [EMAIL PROTECTED]
Subject: [SA-list] Authentication Errors

Hello All,
                I'm running SALIVE v4.0.1376, running as a service. I have my disk space checks configured to use a domain admin account, and everything will run fine for a  while, then suddenly I start getting many alerts that a lot of the drives are down, with the following in the SA log:

Wednesday, August 20, 2003 11:18:15 AM INF: Diskspace check via drive letter due to username
Wednesday, August 20, 2003 11:18:15 AM ERR: connect to host failed:  1219 but ignored due to authenticationerrorignore list

Wednesday, August 20, 2003 11:18:16 AM Sending email message (BOSEX Drive C: is less than 2 gb {10} is DOWN with )
Wednesday, August 20, 2003 11:18:16 AM INF: Diskspace check via drive letter due to username
Wednesday, August 20, 2003 11:18:16 AM ERR: connect to host failed:  1219 but ignored due to authenticationerrorignore list

Wednesday, August 20, 2003 11:18:16 AM Sending email message (BOSEX Drive D: is less than 10 gb {170} is DOWN with )
Wednesday, August 20, 2003 11:18:17 AM INF: Diskspace check via drive letter due to username
Wednesday, August 20, 2003 11:18:17 AM ERR: connect to host failed:  1219 but ignored due to authenticationerrorignore list

Wednesday, August 20, 2003 11:18:17 AM Sending email message (BOSEX Drive E: is less than 10 gb {24} is DOWN with )

Restarting the service seems to fix it. Are there any suggestions to resolve this?

Thanks!

Jesse.

---
avast! Antivirus: Outbound message clean.
Virus Database (VPS): 8/19/2003
Tested on: 8/20/2003 1:29:54 PM
avast! is copyright (c) 2000-2003 ALWIL Software.
http://www.avast.com